diff --git a/.github/workflows/ci-upgrade.yml b/.github/workflows/ci-upgrade.yml
index 82facbf2b..37fe55585 100644
--- a/.github/workflows/ci-upgrade.yml
+++ b/.github/workflows/ci-upgrade.yml
@@ -14,7 +14,7 @@ jobs:
     name: Setup Check
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
   call-upgradesample-calculator:
     name: Upgrade Calculator
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5cc588156..74ca3ef53 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
     name: Setup Check
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
   call-buildsample-calculator:
     name: Build Calculator
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 2cd5ff575..ab8a9ecc0 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -21,12 +21,12 @@ jobs:
       website: ${{ steps.filter.outputs.website }}
       workflows: ${{ steps.filter.outputs.workflows }}
     steps:
-    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # This task is to calculate which projects/paths had file changes
     # Project builds can be skipped in PR if no files changed
     # Changes to the "workflow" files should make projects build
-    - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+    - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
       id: filter
       with:
         filters: |
@@ -91,4 +91,4 @@ jobs:
     runs-on: ubuntu-latest
     needs: [setupcheck, call-buildsample-calculator, call-buildsample-native-module-sample, call-buildwebsite]
     steps:
-     - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/template-buildsample.yml b/.github/workflows/template-buildsample.yml
index 29b565602..6bd3efadd 100644
--- a/.github/workflows/template-buildsample.yml
+++ b/.github/workflows/template-buildsample.yml
@@ -44,7 +44,7 @@ jobs:
     name: "Check if build is required: ${{ !inputs.skipBuild }}"
     runs-on: 'ubuntu-latest'
     steps:
-    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
   build-sample:
     name: Build ${{ inputs.sampleName }} ${{ inputs.configuration }} ${{ inputs.platform }}
@@ -52,10 +52,10 @@ jobs:
     if: ${{ !inputs.skipBuild }}
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: '22.14.0'
 
diff --git a/.github/workflows/template-buildwebsite.yml b/.github/workflows/template-buildwebsite.yml
index b2edd43ab..71b3cfe62 100644
--- a/.github/workflows/template-buildwebsite.yml
+++ b/.github/workflows/template-buildwebsite.yml
@@ -21,7 +21,7 @@ jobs:
     name: "Check if build is required: ${{ !inputs.skipBuild }}"
     runs-on: 'ubuntu-latest'
     steps:
-    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
   build_website:
     name: Build Website
@@ -29,7 +29,7 @@ jobs:
     if: ${{ !inputs.skipBuild }}
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Spell-check docs
       run: npx markdown-spellcheck "docs/*.md" "!docs/*-api-windows.md" --en-us --ignore-acronyms --ignore-numbers --report --color
diff --git a/.github/workflows/template-upgradesample.yml b/.github/workflows/template-upgradesample.yml
index e16e3b8d4..80d50b257 100644
--- a/.github/workflows/template-upgradesample.yml
+++ b/.github/workflows/template-upgradesample.yml
@@ -55,7 +55,7 @@ jobs:
     name: "Check if upgrade is required: ${{ !inputs.skipUpgrade }}"
     runs-on: 'ubuntu-latest'
     steps:
-    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
   upgrade-sample:
     name: Upgrade ${{ inputs.sampleName }} ${{ inputs.configuration }} ${{ inputs.platform }} to ${{ inputs.reactNativeWindowsVersion }}
@@ -63,10 +63,10 @@ jobs:
     if: ${{ !inputs.skipUpgrade }}
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: '22.14.0'
 
diff --git a/.github/workflows/website-publish.yml b/.github/workflows/website-publish.yml
index 65bac5429..5bd487b4d 100644
--- a/.github/workflows/website-publish.yml
+++ b/.github/workflows/website-publish.yml
@@ -21,7 +21,7 @@ jobs:
         git config --global user.name "React-Native-Windows Bot"
         echo "machine github.com login 53619745+rnbot password ${{ secrets.RNBOT_GH_TOKEN }}" > ~/.netrc
     - name: Git Checkout
-      uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Yarn Install (Website)
       run: yarn install --frozen-lockfile
       working-directory: ./website